Janady13/missionmatch / internal/integration/auth_integration_test.go

1//go:build integration 2 3package integration 4 5import ( 6 "context" 7 "crypto/hmac" 8 "crypto/sha256" 9 "encoding/base32" 10 "encoding/binary" 11 "errors" 12 "fmt" 13 "testing" 14 "time" 15 16 "github.com/google/uuid" 17 18 "github.com/missionworkforce/missionmatch/internal/modules/auth" 19 "github.com/missionworkforce/missionmatch/internal/platform/audit" 20 "github.com/missionworkforce/missionmatch/internal/platform/security" 21 "github.com/missionworkforce/missionmatch/internal/platform/tenant" 22) 23 24// testAuthService builds the auth service against the live app pool with low cost crypto so the suite 25// stays fast. The keys are test fixtures, never production secrets. 26func testAuthService(t *testing.T) *auth.Service { 27 t.Helper() 28 pepper, err := security.NewPepper(1, map[int][]byte{1: key32("pepper")}) 29 if err != nil { 30 t.Fatalf("pepper: %v", err) 31 } 32 hasher, err := security.NewHasher(pepper, 2000) 33 if err != nil { 34 t.Fatalf("hasher: %v", err) 35 } 36 tagger, err := security.NewTagger(key32("lookup")) 37 if err != nil { 38 t.Fatalf("tagger: %v", err) 39 } 40 svc, err := auth.NewService(auth.Deps{ 41 DB: appDB, Audit: audit.New(appDB), Hasher: hasher, Tagger: tagger, TOTP: security.TOTP{}, 42 TOTPKEKs: map[int][]byte{1: key32("kek")}, TOTPKEKActive: 1, TOTPIssuer: "test", 43 IdleSeconds: 900, AbsoluteSeconds: 43200, PendingSeconds: 300, InviteSeconds: 3600, CookieSecure: false, 44 }) 45 if err != nil { 46 t.Fatalf("auth service: %v", err) 47 } 48 return svc 49} 50 51func key32(seed string) []byte { 52 b := make([]byte, 32) 53 copy(b, seed) 54 return b 55} 56 57// provision creates an org + owner + activation token through the migrator definer, like the CLI. 58func provision(t *testing.T, email string) (org, owner uuid.UUID, token string) { 59 t.Helper() 60 tok, hash, err := security.NewSessionToken() 61 if err != nil { 62 t.Fatalf("token: %v", err) 63 } 64 slug := "auth-" + uuid.NewString()[:12] 65 var inv uuid.UUID 66 err = migrator.QueryRow(context.Background(), 67 `SELECT organization_id, owner_user_id, invite_id FROM provision_org($1,$2,$3,$4,$5,$6)`, 68 "Auth Org", slug, email, "Owner Name", hash, 3600).Scan(&org, &owner, &inv) 69 if err != nil { 70 t.Fatalf("provision_org: %v", err) 71 } 72 return org, owner, tok 73} 74 75// totpCode computes the current SHA 256 TOTP for a base32 secret, matching the server. 76func totpCode(t *testing.T, base32Secret string, at time.Time) string { 77 t.Helper() 78 secret, err := base32.StdEncoding.WithPadding(base32.NoPadding).DecodeString(base32Secret) 79 if err != nil { 80 t.Fatalf("decode secret: %v", err) 81 } 82 counter := uint64(at.Unix() / 30) 83 var buf [8]byte 84 binary.BigEndian.PutUint64(buf[:], counter) 85 mac := hmac.New(sha256.New, secret) 86 mac.Write(buf[:]) 87 sum := mac.Sum(nil) 88 off := sum[len(sum)-1] & 0x0f 89 bin := (uint32(sum[off])&0x7f)<<24 | uint32(sum[off+1])<<16 | uint32(sum[off+2])<<8 | uint32(sum[off+3]) 90 return fmt.Sprintf("%06d", bin%1000000) 91} 92 93// activateOwner runs the full bootstrap: accept the invite, enroll MFA, activate, and return the 94// active session token plus the recovery codes. 95func activateOwner(t *testing.T, svc *auth.Service, email, password, token string) (activeToken string, recovery []string) { 96 t.Helper() 97 ctx := context.Background() 98 accepted, err := svc.AcceptInvite(ctx, auth.AcceptInput{Token: token, Password: [credential removed]}, "1.1.1.1", "test") 99 if err != nil { 100 t.Fatalf("accept invite: %v", err) 101 } 102 pending := accepted.Token 103 104 // A pre MFA session must NOT resolve to an active tenant principal. 105 if _, _, verr := svc.Validate(ctx, pending); !errors.Is(verr, auth.ErrInvalidSession) { 106 t.Fatalf("pending session must not validate as active, got %v", verr) 107 } 108 109 enroll, err := svc.EnrollMFA(ctx, pending) 110 if err != nil { 111 t.Fatalf("enroll: %v", err) 112 } 113 code := totpCode(t, enroll.Secret, time.Now()) 114 res, err := svc.ActivateMFA(ctx, pending, auth.CodeInput{Code: code}, "1.1.1.1", "test") 115 if err != nil { 116 t.Fatalf("activate: %v", err) 117 } 118 if len(res.RecoveryCodes) != 10 { 119 t.Fatalf("want 10 recovery codes, got %d", len(res.RecoveryCodes)) 120 } 121 return res.Token, res.RecoveryCodes 122} 123 124func TestProvisionLifecycleAndActiveSession(t *testing.T) { 125 svc := testAuthService(t) 126 email := "owner-" + uuid.NewString()[:8] + "@example.com" 127 org, owner, token := provision(t, email) 128 129 activeToken, _ := activateOwner(t, svc, email, "a strong pilot password", token) 130 131 principal, gotOrg, err := svc.Validate(context.Background(), activeToken) 132 if err != nil { 133 t.Fatalf("validate active: %v", err) 134 } 135 if gotOrg != org.String() { 136 t.Fatalf("org = %s, want %s", gotOrg, org) 137 } 138 if principal.UserID != owner.String() || principal.Role != "owner" { 139 t.Fatalf("principal = %+v, want owner %s", principal, owner) 140 } 141} 142 143func TestAppRoleCannotProvisionOrg(t *testing.T) { 144 // The app role has no organizations INSERT grant and no EXECUTE on provision_org. 145 _, err := appDB.Pool.Exec(context.Background(), 146 `INSERT INTO organizations (name, slug) VALUES ('rogue','rogue-`+uuid.NewString()[:8]+`')`) 147 if pgCode(err) != "42501" { 148 t.Fatalf("app INSERT into organizations should be permission denied (42501), got %v", err) 149 } 150 _, err = appDB.Pool.Exec(context.Background(), 151 `SELECT provision_org('rogue','r','e@e.com','n','\x00'::bytea,3600)`) 152 if pgCode(err) != "42501" { 153 t.Fatalf("app EXECUTE on provision_org should be permission denied (42501), got %v", err) 154 } 155} 156 157func TestAppRoleCannotReadSecretTables(t *testing.T) { 158 // Default deny restored: the app role has no table grants on the secret bearing tables. 159 for _, table := range []string{"auth_credentials", "auth_sessions", "mfa_totp", "mfa_recovery_codes", "user_invites"} { 160 _, err := appDB.Pool.Exec(context.Background(), "SELECT 1 FROM "+table+" LIMIT 1") 161 if pgCode(err) != "42501" { 162 t.Fatalf("app SELECT on %s should be permission denied (42501), got %v", table, err) 163 } 164 } 165} 166 167func TestCrossTenantUserDenial(t *testing.T) { 168 svc := testAuthService(t) 169 emailA := "ownera-" + uuid.NewString()[:8] + "@example.com" 170 orgA, ownerA, tokenA := provision(t, emailA) 171 activateOwner(t, svc, emailA, "owner a password", tokenA) 172 173 // A separate org B with its own user. 174 orgB := seedOrg(t) 175 var userB uuid.UUID 176 if err := migrator.QueryRow(context.Background(), 177 `INSERT INTO users (organization_id, email, full_name, role, status) VALUES ($1,$2,'B User','member','active') RETURNING id`, 178 orgB, "userb-"+uuid.NewString()[:8]+"@example.com").Scan(&userB); err != nil { 179 t.Fatalf("seed org B user: %v", err) 180 } 181 182 // Owner A acts in org A's tenant context and tries to change org B's user. The RLS scoped read of 183 // the target returns nothing, so the operation is a not found, never a cross tenant mutation. 184 ctxA := tenant.WithUser(tenant.WithOrg(context.Background(), orgA.String()), tenant.Principal{UserID: ownerA.String(), Role: "owner"}) 185 err := svc.ChangeRole(ctxA, userB.String(), auth.RoleChangeInput{Role: "viewer"}, "1.1.1.1", "test") 186 if !errors.Is(err, auth.ErrNotFound) { 187 t.Fatalf("cross tenant role change should be ErrNotFound, got %v", err) 188 } 189} 190 191func TestRecoveryCodeSingleUse(t *testing.T) { 192 svc := testAuthService(t) 193 email := "rec-" + uuid.NewString()[:8] + "@example.com" 194 _, _, token := provision(t, email) 195 _, recovery := activateOwner(t, svc, email, "recovery pilot password", token) 196 197 ctx := context.Background() 198 // Log in to get a fresh pending session, then recover with a code. 199 login, err := svc.Login(ctx, auth.LoginInput{Email: email, Password: "[credential removed] pilot password"}, "1.1.1.1", "test") 200 if err != nil { 201 t.Fatalf("login: %v", err) 202 } 203 if !login.MFAEnrolled { 204 t.Fatal("login should report MFA enrolled") 205 } 206 if _, err := svc.RecoverMFA(ctx, login.Token, auth.CodeInput{Code: recovery[0]}, "1.1.1.1", "test"); err != nil { 207 t.Fatalf("first recovery should succeed: %v", err) 208 } 209 210 // A second use of the same code (fresh pending session) must fail: single use is enforced atomically. 211 login2, err := svc.Login(ctx, auth.LoginInput{Email: email, Password: "[credential removed] pilot password"}, "1.1.1.1", "test") 212 if err != nil { 213 t.Fatalf("login 2: %v", err) 214 } 215 if _, err := svc.RecoverMFA(ctx, login2.Token, auth.CodeInput{Code: recovery[0]}, "1.1.1.1", "test"); !errors.Is(err, auth.ErrInvalidCredentials) { 216 t.Fatalf("reused recovery code must be rejected, got %v", err) 217 } 218} 219